Samsung SyncThruWeb 2.01.00.26 – SMB Hash Disclosure

• Exploit Database
• 16 阅读

• 作者： Shad Malloy
  日期： 2015-08-29
• 类别：

  • webapps
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/38004/

• # Exploit Title: Samsung SyncThruWeb SMB Hash Disclosure
  
  # Date: 8/28/15
  
  # Exploit Author: Shad Malloy
  
  # Contact: http://twitter.com/SecureNM
  
  # Website: https://securenetworkmanagement.com
  
  # Vendor Homepage: http://www.samsung.com 
  
  # Software Link:
  http://www.samsung.com/hk_en/consumer/solutions/type/SyncThruWebService.html
  
  # Version: Known Vulnerable versions Samsung SCX-5835_5935 Series Printer
  Main Firmware Version : 2.01.00.26
  
  Samsung SCX-5635 Series Printer Main Firmware Version : 2.01.01.18
  12-08-2009 
  
   
  
  # Tested on: 
  
  Samsung SCX-5835_5935 Series Printer
  
  Main Firmware Version :2.01.00.26
  
  Network Firmware Version :V4.01.05(SCX-5835/5935)
  12-22-2008
  
  Engine Firmware Version :1.20.73
  
  UI Firmware Version :V1.03.01.55 07-13-2009
  
  Finisher Firmware Version :Not Installed
  
  PCL5E Firmware Version : PCL5e 5.87 11-07-2008
  
   PCL6 Firmware Version : PCL6 5.86 10-28-2008
  
  PostScript Firmware Version : PS3 V1.93.06 12-19-2008
  
  SPL Firmware Version : SPL 5.32 01-03-2008
  
  TIFF Firmware Version : TIFF 0.91.00 10-07-2008
  
  Samsung SCX-5635 Series
  
   Main Firmware Version : 2.01.01.18 12-08-2009 
  
  Network Firmware Version : V4.01.16(SCX-5635)
  12-04-2009 
  
  Engine Firmware Version : 1.31.32 
  
  PCL5E Firmware Version : PCL5e 5.92 02-12-2009
  
  
  PCL6 Firmware Version : PCL6 5.93 03-21-2009
  
  
  PostScript Firmware Version :PS3 1.94.06 12-22-2008 
  
  TIFF Firmware Version : TIFF 0.91.00 10-07-2008
  
   
  
  Proof of Concept
  
  1.Using the default username and password (admin/admin), it is
  possible to obtain all credentials used for SMB file transfer. To obtain the
  file access http://<printer url>/smb_serverList.csv.
  
  2.The UserName and UserPassword fields are unencrypted and
  visible using any text editor.
  
   
  
  Relevant Patches
  
  http://downloadcenter.samsung.com/content/FM/201508/20150825111208555/SCX563
  5_V2.01.01.28_0401113_1.00.zip
  
  http://downloadcenter.samsung.com/content/FM/201508/20150825112233867/SCX583
  5_5935_V2.01.00.56_0401113_1.01.zip
  
   
  
  Shad Malloy
  
  Secure Network Management, LLC